Large-scale analysis of format string vulnerabilities in Debian Linux

Abstract

Format-string bugs are a relatively common security vulnerability, and can lead to arbitrary code execution. In collaboration with others, we designed and implemented a system to eliminate format string vulnerabilities from an entire Linux distribution, using typequalifier inference, a static analysis technique that can find taint violations.We successfully analyze 66% of C/C++ source packages in the Debian 3.1 Linux distribution. Our system finds 1,533 format string taint warnings. We estimate that 85% of these are true positives, i.e., real bugs; ignoring duplicates from libraries, about 75% are real bugs.We suggest that the technology exists to render format string vulnerabilities extinct in the near future.

Runtime countermeasures for code injection attacks against C and C++ programs

“…The attacker is now able to control what the function pops from the stack and can make the program write to arbitrary memory locations. Chen and Wagner [2007] suggest that format string vulnerabilities are more common than previously thought, although not as prevalent as buffer overflows: they found 1533 possibly format string vulnerabilities (of which they assume 85% are real vulnerabilities) on 92 million lines of code that they analyzed on a Debian Linux system. 2.4.2 Exploitation.…”

Countering code injection attacks: a unified approach

“…Secure Coding Practices [27,37,50] Lexical Analysis [9,10,49,54] Data-Flow Analysis [17,30] Context Free Grammars [52,53] New APIs [13,36] Learning [15,32,48] Query Modification [4,7,46] Runtime Tainting [22,29,42,56] Data-Flow Analysis [51] Hybrid [24,25,35] Syntax Embeddings [5] Intrusion Set Randomization [3,28,31] The most straightforward and sensible approach is the adoption of secure coding practices [27,50,37], like the ones we mentioned above to prevent sql code injection. However, this does not always happen, as programmers may not be aware of them, or time schedules may be tight, encouraging sloppy practices instead.…”

“…Then, the resulting tokens are associated with vulnerable function calls susceptible to buffer overflows like gets, strcpy and scanf. This approach is taken by security utilities like its4, 4 Flawfinder 5 and rats 6 [54,10,9,49]. However, these tools suffer from several false positive and negative reports [11,14].…”

Implicit Flows: Can’t Live with ‘Em, Can’t Live without ‘Em

“…Explicit flow analysis tools [9,16,24] can be used to detect a variety of integrity violations, such as SQL injection vulnerabilities [16,9], format string vulnerabilities [6,21], missed access control checks [25], and user-kernel pointer bugs [13]. These tools can also be used to check confidentiality-oriented properties, to ensure that secret data is not inadvertently leaked.…”

“…For example, tools have been developed, in research and industry, to uncover SQL injection vulnerabilities [16,9], missed access control checks [25], user-kernel pointer bugs [13], and format string vulnerabilities [6,21]. At their core, these tools are quite similar in that they track the flow of security-relevant data through the program.…”